メニュー
Adds authorization matrix coverage to Playwright specs. Use when testing pages with role or ownership rules so tests assert visible, hidden, disabled, and forbidden action states.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
When changing API routes, auth, or env-dependent behavior, add or update the corresponding integration tests and keep the test file layout consistent.
When adding or changing files under infra/k8s/ or sync targets for k8s, know what Argo CD syncs and remind the user to push to Git so the cluster can sync.
Keeps tools/generate-data seeders and docs in sync when main or management DB schema or ORM entities change. Use when adding or changing tables/entities in packages/orm, packages/management-orm, or infra database migrations.
When changing DB schema or permission dimensions, consider predefined roles and bucket_role / role-related code.
Use when adding or changing environment variables, infra/env/classification YAML, scripts/env-classification, K8s env render, or local env generation.
Common patterns for the Boilerplate HTTP API (Express)
| name | e2e-authz-matrix |
| description | Adds authorization matrix coverage to Playwright specs. Use when testing pages with role or ownership rules so tests assert visible, hidden, disabled, and forbidden action states. |
| version | 1.0.0 |
Use this skill for permission-sensitive routes and controls. Current E2E bar: Confident (see e2e-crud-state-matrix).
For permission-gated edit/detail/settings specs, apply the full permission actor matrix process so all actor × outcome permutations are tested (unauthenticated, owner, non-owner with/without permission, non-admin, plus list→edit and Cancel→list). See the e2e-permission-actor-matrix skill for the step-by-step process and the reference implementation: web bucket-admin-edit is implemented across the bucket-admin-edit-*.spec.ts specs in apps/web/e2e/ (unauthenticated, bucket-owner, bucket-admin, admin-without-permission, non-admin).
For each protected surface, include at least:
visible vs not rendered) by role.enabled vs disabled) by role/row state.view/edit/delete action gating.For authZ tests, set the user context so the E2E HTML report shows which role/CRUD permissions are in effect. Call setE2EUserContext(testInfo, '…') at the start of each test (see e2e-readability skill). The report will display "User context: " in the test section and summary.